CVE-2025-62185

6.7

MEDIUMCVSS v3

Published

October 7, 2025

Affected

6 projects

Assigned by

MITRE

Severity scale

010

Description

In Ankitects Anki before 25.02.5, a crafted shared deck can place a YouTube downloader executable in the media folder, and this is executed for a YouTube link in the deck. The executable name could be youtube-dl.exe or yt-dlp.exe or yt-dlp_x86.exe.

ankitects/anki

GitHubAnki is a smart spaced repetition flashcard program

< 25.02.5NVD

anki

Crates.ioThis crate is currently only available through the GitHub repo.

< 25.02.5NVD

anki

Python Package Index

More on this CVE

NVD↗GitHub Advisory↗

Python library for Anki, the spaced repetition flashcard program

< 25.02.5NVD

anki

RubyGemsGenerate decks ready to be imported into Anki! Just pass an array of hashes and get back a string that you can save in a file and import directly into Anki.

< 25.02.5NVD

anki

NPMhandle anki .apkg fils

< 25.02.5NVD

dennmart/anki

GitHubGenerate decks ready to be imported into Anki!

< 25.02.5NVD

Security Advisories

CVE-2025-62185

Description

More on this CVE